Git's on disk format has a massive attack surface.

Do not run "git" in untrusted directories. It is not hardened against that (as opposed to the network protocol).

That probably includes libgit2 unless it explicitly states the opposite.

The blurb made it sound like it checks the git status by default. But this isn't the case. You have to explicitly ask for with --git. Never mind then.